System and method for converting an input signal into an output signal

ABSTRACT

A system and a method for processing data obtained from an input signal including physiological information representative of at least one at least partially periodic vital signal. The physiological information is derivable from visible radiation reflected by an object. The system includes a detector for detecting at least one vital signature in the input signal and a converter for creating an output signal by modifying the input signal depending on the detected vital signature. The output signal includes an artificial signature at least partially replacing a respective vital signature of the at least one vital signature of the input signal. The system may further include a sensor for detecting visible electromagnetic radiation within at least one particular wavelength range.

FIELD OF THE INVENTION

The present invention relates to a system and a method for processingdata for converting an input signal into an output signal, wherein theinput signal comprises physiological information derivable fromelectromagnetic radiation, in particular from a sequence of imageframes. Further, the present invention relates to a computer program forimplementing said method.

BACKGROUND OF THE INVENTION

Recently, in the field of image processing enormous progress was made inthat, besides the mere representation of recorded images, profoundanalyses of the recorded data were enabled. In particular, when recordeddata comprises representations of living beings, such as animals oreven, more particularly, human beings, conclusions regarding thepersonality or even the well-being of the individual can be enabled.

In this context, U.S. Pat. No. 6,067,399 A discloses a method and anapparatus for recording video data. The method comprises the steps ofreceiving unrecorded video data representative of a subject; detectingskin tone detail of said subject; manipulating said video datacorresponding substantially only to said detected skin tone detail toobscure said video data corresponding to said detected skin tone detail;and recording said video data including said manipulated video data.

Hence, it is enabled to ensure the privacy of the identity of a recordedsubject by masking respective parts of the subject in the recorded videodata.

However, such a rigorous masking is inapplicable when it is required ordesired to recognize the subject, such as a human being, at least to acertain extent. These needs can exist, by way of example, in the fieldof video conferencing, security monitoring, health monitoring etc.

A further challenge is related to the fact that meanwhile images andsequences thereof are digitally recorded, processed and reproduced, andcan be duplicated without loss. As a result, an increased risk of a lossof control of personal information might arise.

SUMMARY OF THE INVENTION

It is an object of the present invention to provide a system and amethod for processing data addressing the above-mentioned drawbacks andenabling a representation and circulation of recorded data whilepreserving a certain level of privacy, and while still allowing acertain level of human perception of the processed data whenrepresented.

Furthermore, it would be advantageous to provide a system enablingrecording of data while, substantially simultaneous, ensuring aprocessing of recorded data addressed to privacy preservation measures,and while also preventing an unauthorized access to preprocessedrecorded data.

In a first aspect of the present invention a system for processing dataobtained from an input signal comprising physiological information ispresented, wherein the physiological information is derivable fromvisible radiation reflected by an object, the physiological informationbeing representative of at least one at least partially periodic vitalsignal, the system comprising:

a detector means for detecting at least one vital signature in the inputsignal, the at least one vital signature varying over time andcorresponding to the at least one at least partially periodic vitalsignal,

a converter means for creating an output signal by modifying the inputsignal depending on the detected vital signature,

wherein the output signal comprises an artificial signature at leastpartially replacing a respective vital signature of the at least onevital signature of the input signal.

The invention is based on the idea that the physiological informationwhich is subjected to be analyzed in order to extract certain personalinformation therefrom can be modified without substantially affecting anoverall perceptibility of the recorded object. Overall perceptibilityshall be understood as referring to a general visual perceptibility of ahuman being. In other words, it is taken advantage of the fact that, ingeneral, human eyesight is far less developed in this context thanrecognition and processing based on digital logic algorithms andoperations, e.g. digital image processing.

Hence, sophisticated methods and devices for image processing can beexploited in that they are utilized in a manner diametrically opposed totheir originally intended use, namely for detecting physiologicalinformation to be subjected to analyses and for modifying it in a way asto permit, or, at least, affect or influence further subsequent analysisthereof. It goes without saying that a modification of the input signalresulting in an output signal can also comprise a removal or eliminationof the at least one vital signature in that the created artificialsignature can be considered a blank signature.

After the recorded data is being processed, a user may forward, copy orshare it without risking an uncovering of an intimate level of privacyof the recorded object of interest, namely the recorded living being,or, in particular, the recorded human being.

An example of how information can be extracted from recorded image dataof living beings is described in WO 2010/100594 A2. This documentdiscloses a method of processing images of at least one living being,including obtaining a sequence of digital images taken at consecutivepoints in time; selecting at least one measurement zone comprising aplurality of image points, wherein the step of selecting at least onemeasurement zone includes analyzing information based on pixel data of aplurality of image parts in at least one of the images, each image partincluding at least one image point, and selecting each measurement zonefrom contiguous parts determined to have similar characteristics; andfor each measurement zone, obtaining a signal representative of at leastvariations in a time-varying average value of a combination of pixelvalues at at least a number of the image points for use in determiningat least one of a presence and a frequency value of at least one peak ina spectrum of the signal corresponding to a frequency of a periodicphysiological phenomenon. Several embodiments of how to improve thedetection of the desired values are also disclosed in this document.

There exist several embodiments of the detector means and the convertermeans. In a first, fairly simple embodiment both the detector means andthe converter means are embodied by a processing unit, in particular aprocessing unit of a personal computer, which is driven by respectivelogic commands. Such a processing unit may comprise also suitable inputand output interfaces.

However, in the alternative, each of the detector means and theconverter means can be embodied by a separate processing unit driven ordrivable by respective commands. Hence, each respective processing unitcan be adapted to its special purpose. Consequently, a distribution oftasks may be applied, wherein distinct tasks are processed, forinstance, executed on a single processor of a multi-processor processingunit, or, again referring to a personal computer, imageprocessing-related tasks are executed on an image processor while otheroperational tasks are executed on a central processing unit.

According to a preferred embodiment of the system for processing datathe input signal comprises a continuous or discrete sequence of imageframes related to a specific signal space.

According to an even further embodiment of the system for processingdata the at least one at least partially periodic vital signal isselected from the group consisting of heart rate, respiration rate, andheart rate variability. Hence, it can be envisaged to modify each vitalsignal, or, if required, merely a single desired vital signal whileleaving another vital signal basically unmodified.

Such vital information can be obtained from slight variations of, by wayof example, skin tone details over time. Blood circulation andrespiration are correlated with slightest changes of skin color,particularly when focusing vasculature. When capturing a sequence ofimage frames of an area of interest indicative of the desired skin colorchanges to be detected the variations over time can be excluded andassessed by means of logic algorithms, even though the changes cannot bedetected by a person watching a playback of the recorded sequence ofimage frames by means of human perceptibility.

Thus, forwarding or distributing of unprocessed video data or the likesubstantially may bear the risk of unintentionally providing personalinformation to other parties. It could be intended to misuse such dataand information extracted therefrom, e.g. for assessing the physicalhealth or mental health of the recorded person.

According to an even further embodiment of the system for processingdata the detector means is adapted to detect temporal variations of theat least one vital signature, the temporal variations being indicativeof the at least one at least partially periodic vital signal.

This embodiment is preferably further developed such that the convertermeans comprises a submeans selected from the group consisting of aleveling means for leveling the temporal variations of the at least onevital signature, a mask means for removing the at least one vitalsignature from the input signal, an evaluation facilitating means forenhancing the amplitude of the vital signal indicative of temporalvariations of the at least one vital signature, and a modulator meansfor modifying the temporal variations of the at least one vitalsignature, the modulator means being adapted for applying a frequencymodification to the temporal variations.

There exist various embodiments of the submeans associated with theconverter means. It goes without saying that the submeans also can beembodied by a processing unit driven by respective logic commands.

When the submeans is configured as a leveling means the temporalvariations of the at least one vital signature can be planed in a way asto prevent a subsequent analyzing process from isolating the desiredinformation from the recorded data. In other words, when applying, forinstance, a heart rate analysis to the processed data, a zero-signalcould be detected on which no further analysis can be based.

It should be understood that the leveling or planing is substantiallydirected to align the detected variations indicative of the at least oneat least partially periodic vital signal with overall variations of thewhole image frame over time. The so-called overall variations can beinduced by changes of local conditions or illumination, or, in general,by noise signals. In this respect, the output signal is not completelyleveled but rather no longer overlaid by the additional temporalvariations enabling the extraction of the vital signal. The variationsof the at least partially periodic vital signal are very small comparedto the general noise-induced overall variation. By way of example, theratio therebetween can be less than about 5:100 to less than about 1:100in regard of the signal level variations.

It should be also understood that no complete leveling of the temporalvariations of the at least one vital signature is required as even aleveling to a certain extent is considered to be sufficient to preservethe required level of privacy. Even when slight amplitudes of thedesired signal would remain, an extraction of the signal can besufficiently impeded.

The other way round, when the submeans is configured as an evaluationfacilitating means, it can be envisaged to superelevate the detectedtemporal variations indicative of the at least one at least partiallyperiodic vital signal. Hence, the signal to noise ratio can be improvedin order to facilitate a subsequent determination of the desired vitalsignal.

Alternatively, the submeans can be configured as a mask means which isadapted for replacing the temporal variations of the at least one vitalsignature by generally constant values. The mask means and the levelingmeans are different from each other in that the mask means is notadapted for leveling the temporal variations of the at least one vitalsignature by aligning it with the overall variations of the image frame,but rather by replacing it by values not significantly aligned with orinfluenced by the overall variations.

In other words, for instance, when masking the face of a person recordedwith the mask means a “china doll” face impression could be perceived byan observer. That is, at the level of image pixels pixel valuesassociated with a skin portion to be analyzed (and subjected to varyover time in the input signal due to the temporal variations of the atleast one at least partially periodic vital signal and, to a greaterextent, to overall noise) are replaced by pixel values, e.g. of atypical skin color, generally constant or steady over time.

It is also preferred if the submeans is configured as a modulator meanswhich might be applied to “fake” the desired vital signal. By modifyingthe frequency of the temporal variations an artificial vital signal isgenerated which can be extracted during subsequent analyzing activitiesbut, however, does not enable to grasp the original vital signature.

An effective preservation of a certain level of privacy also can beachieved by this measure. It can be envisaged to replace the originalfrequency by a set frequency or by a frequency varying over time,thereby imitating a natural frequency graph.

According to a further preferred embodiment the converter meanscomprises an overall converter for varying a major portion of the imageframes, the major portion also comprising a non-indicative signature,wherein the overall converter is preferably adapted for applying adestructive modulation to the temporal variations of the at least onevital signature. Moreover, the modulation can comprise a spatial ortemporal modification of input signal components.

Needless to say, the major portion of the image frame comprises the atleast one vital signature besides the non-indicative signature. In thisembodiment it is further preferred that the destructive modulationcomprises a multi mixing of image components which is further preferredcarried out in a random manner. However, also the destructive modulationpreferably is to be limited to a certain extent, namely to a level stillallowing a recognition of image objects by a human observer.

According to still a further preferred embodiment the converter means isadapted to apply a multi stage conversion to the at least one vitalsignature.

By way of example, the multi stage conversion can comprise a frequencymodification applied to the temporal variations of the at least onevital signature carried out by the modulator means and a subsequent maskoperation for removing the (remainder of the) at least one vitalsignature carried out by the mask means. For enhancing the level ofprivacy preservation a further process, for instance, a destructivemodulation carried out by the overall converter, can be applied. In thiscontext, it can be also envisaged to apply a random multi stageconversion or a fixed stage sequence conversion to the input signal.

According to a preferred embodiment the system for processing datafurther comprises a sensor means for detecting a visible electromagneticradiation within at least one particular wavelength range selected fromthe group consisting of visible light, infrared light, and ultravioletradiation, the sensor means being connectable to the input channel.

There exist various embodiments of the sensor means. In a first, simpleembodiment the sensor means comprises a camera adapted to capture imageframes in a defined signal space having a multiple spectrum, forinstance, RGB, sRGB, Rg traumaticity, HSV, HSL, CMYK, YPbPr, YCbCr,xvYCC, and suchlike.

By way of example, the sensor means can be embodied by conventionaldigital cameras adapted for recording sequences of images, e.g. bymonitoring or observing cameras, for instance in the field of healthmonitoring or security monitoring, and also by so-called web cams.

In case a special purpose camera is applied, this embodiment can befurther developed such that the detector means, the converter means andthe sensor means are arranged in a common housing. That is, also theinput channel can be disposed in the housing such that an externalaccess thereto is impeded. Hence, the preservation of the desired levelof privacy is further enhanced as the input signal cannot be picked upin an unmodified state.

This embodiment is preferably further developed in that the systemcomprises a buffer means for buffering the input signal, the buffermeans comprising an access protection for preventing an unauthorizeddata access. There are several embodiments of the buffer means, such assoftware buffers or hardware buffers, e.g. semiconductor memory, such asRAM, ROM, EPROM and the like.

As the buffer means, in principle, is a weak point an unauthorized dataaccess could be addressed to, it is appreciated to apply furthermeasures for protecting the buffer means. Such measures can be embodiedas software measures, hardware measures or a combination thereof. Aproper software measure could be an encryption of the buffered data. Ahardware measure could be embodied by a housing comprising a seal. In apreferred embodiment a breakage of the seal can be detected or,alternatively, leads to a break of a signal line for the input signal.

It could be further advantageous to provide an access control connectedto a bypass line, wherein the access controller is adapted to allow, onauthorized demand, a direct access to the input signal.

Adapted in this manner, the system can run on two operation modes,namely a privacy preservation mode and an immediate data access mode.The latter mode could be applied, for instance, when specialrequirements are to be fulfilled. Such requirements could be desirablein cases of epidemics, such as influenza and the like, where the healthof a recorded living being is to be assessed. By way of example, typicalapplications therefor can be envisaged in the field of border controls,health monitoring, or monitoring of public places and publictransportation.

According to another preferred embodiment the detector means is furtheradapted for applying a color normalization and a luminance normalizationto the signal space.

This measure serves to further facilitating the detection of the atleast one vital signature in the input signal as the degree of freedomin the specific signal space is reduced leading to a simplifiedextraction.

The color normalization can comprise the detection of time-averagevalues for distinct signal components and the calculation of normalizedvalues of respective color components by applying the time-averagevalues to given actual values of the input signal, e.g. by a movingaverage calculation wherein actual values are divided by moving averagevalues thereof.

The luminance normalization can comprise a modification ofcolor-representative components of the input signal by applying adefined combination of primary color components thereto. In this way,temporal variations induced by varying illumination conditions can bereduced or even eliminated, e.g. by a division of color-representativecomponents of the input signal by a determined linear combination ofprimary color components.

When applying both the color normalization and the luminancenormalization to the signal space, the problem underlying the detectingof the at least one vital signature can by simplified by a reduction toan algebraic calculation related to fewer dimensions.

In another aspect of the present invention a method for processing dataobtained from an input signal is presented, wherein the input signalcomprises physiological information derivable from visible radiationreflected by an object, the physiological information beingrepresentative of at least one at least partially periodic vital signal,the method comprising:

receiving an input signal from an input channel,

detecting at least one vital signature in the input signal, the at leastone vital signature varying over time and corresponding to the at leastone at least partially periodic vital signal,

creating an output signal by modifying the input signal depending on thedetected vital signature, wherein the output signal comprises anartificial signature at least partially replacing a respective vitalsignature of the at least one vital signature of the input signal, and

delivering the output signal to an output channel.

Advantageously, the method can be carried out using the system forprocessing data of the invention.

According to an even further aspect of the invention a computer programis presented, the computer program comprising program code means forcausing a computer to carry out the steps of the method for processingdata of the invention when said computer program is carried out on acomputer.

Preferred embodiments of the invention are defined in the dependentclaims. It shall be understood that the claimed method has similarand/or identical preferred embodiments as the claimed device and asdefined in the dependent claims.

BRIEF DESCRIPTION OF THE DRAWINGS

These and other aspects of the invention will be apparent from andelucidated with reference to the embodiments described hereinafter. Inthe following drawings

FIG. 1 shows a schematic illustration of a general layout of a system inwhich the present invention can be used,

FIG. 2 shows a first part of a block diagram illustrating a first partof an embodiment of a system in which the present invention can be used,

FIG. 3 shows a second part of the block diagram of the embodiment of thesystem according to FIG. 2,

FIG. 4 shows a schematic block diagram of an embodiment of a systemaccording to the present invention,

FIG. 5 shows a further schematic block diagram of another embodiment ofa system according to the present invention,

FIG. 6 shows a block diagram illustrating several steps of an embodimentof a method according to the present invention, and

FIG. 7 shows a sample schematic illustration of a signal space to whicha normalization can be applied.

DETAILED DESCRIPTION OF THE INVENTION

Referring to FIG. 1, a system for processing data is illustrated anddenoted by a reference numeral 10. The system 10 can be utilized forrecording image frames of an object 16. The object 16 can be a humanbeing or animal, or, in general, a living being. For extracting desiredinformation from the recorded data a defined part or portion of theobject can be recorded by capturing a series of image frames over time.A proper data base for subsequent image processing can be created insuch a way. Several extraction steps can be applied to the collecteddata, so as to gain a vital signal 18 therefrom, such as heart rate,respiration rate, or heart rate variability. The vital signal 18 can beconsidered an illustrative example of several vital signals derivablefrom captured image sequences. As mentioned above, WO 2010/100594 A2discloses a method of extracting the desired signals by analyzing asequence of image frames as well as several refinements thereof. Itcould be demonstrated that even under poor conditions with respect to,by way of example, luminance, color and motion conditions the extractionof the desired signal can be achieved.

However, it is often desired to preserve the privacy of the recordedobject 16 in that the extraction of such desired signals is preventedor, at least, impeded to a certain extent while the object 16 is stillrecognizable. As more and more data is being collected in everyday life,the risk of data abuse also raises accordingly. Potential scenarios inthis context can be envisaged with little imagination, e.g., in thefield of video interviews, security surveillance or health monitoring.For instance, from video data recorded at a press conference of apolitician, it could be possible to retrieve the heart rate of thepolitician which might then be used to make conclusions on the healthstatus, real thinking or the validity of his statements, which might beundesired. Hence, a possible application for the invention could be toadmit only cameras for use in such press conferences that are certifiedthat such conclusions cannot be made, e.g. because the present inventionis implemented in said camera to prevent that.

The potentially desired vital signal 18 can be derived fromelectromagnetic radiation, in particular from visible radiation 20. Thedesired vital signal 18 can be contained in the visible radiation 20and, moreover, in electromagnetic radiation in general. Also ultravioletradiation and infrared radiation can be envisaged besides visibleradiation. To this end, it is worth noting that the respective radiationcan be reflected or even emitted by the object 16, the latter of whichis the case, by way of example, at least partially, when, either inaddition or exclusively, detecting infrared radiation.

Needless to say, the system 10 also could be utilized without anintegrated sensor means 22 by processing data already captured andstored or buffered.

Taking into consideration the privacy preservation need outlined above,the system 10 is further adapted to process the data which can bederived from the visible radiation 20 recorded by a sensor means 22 andobtainable from an input signal 24. The input signal 24 can be deliveredto an input channel 26. The system 10 further comprises a subsystem 12wherein a detector means 28 and a converter means 30 are disposed. Thedetector means 28 can be connected to the input channel 26 so as toreceive the input signal 24 on demand.

The detector means 28 can be utilized to detect the desired vital signal18. Hence, the vital signal 18 can be extracted from the input signal24. However, no external access to the vital signal 18 is provided asthe system 10 is merely utilized for a subsequent modification of theinput signal 24. Moreover, several access limitations can be utilized inthis context at the detector means 28, the converter 30, or, in general,the submeans 12 for privacy preservation measures.

The converter means 30 can be connected to an output channel 32 to whichan output signal 34 can be delivered. The converter means 30 is furtheradapted for creating the output signal 34 by modifying the input signal24 in that the vital signal 18 cannot be extracted therefrom anymore.Instead, an artificial signal 40 can be extracted from the output signal34. Hence, the privacy of the recorded object 16 is adequately protectedwhile still allowing a proper representation of the recorded object. Theinput channel 26 and the output channel 32 can be embodied by a bussystem provided with respective interfaces. It goes without saying thatthe detector means 28 and the converter means 30 can be implemented bymeans of a processing unit comprising one or more processors.

The output signal 34 comprises at least one processed image frame 36comprising processed physiological information 38. In the event that anextraction of a desired vital signal (cf. reference numeral 18 inFIG. 1) is applied to the output signal 34, merely an artificial signal40 a, 40 b, 40 c can be detected. By way of example, the artificialsignals 40 a, 40 b, 40 c illustrate alternative modifications applied tothe input signal 24. Substantially, the artificial signals 40 a, 40 ccan be considered a proper result of the extraction of the desiredsignal. However, as the at least one processed image frame 36 comprises“fake information”, also the detectable artificial signals 40 a, 40 ccannot indicate the vital signal 18 originally aimed at. The signal 40 ais indicative of a value of interest that is, e.g. when assessing theheart rate, too large by definition while the signal 40 c is indicativeof a value of interest that is too small by definition.

According to one embodiment, when analyzing the output signal 34, themodification of the original input signal 24 remains concealed. In thealternative, it could be appreciated that the output signal 34 indicatesthat a modification thereof has been carried out. To this end, whenanalyzing the output signal 34, an artificial signal 40 b can bedetected that clearly differs from assumed vital signals. Again, itshould be noted that the modification carried out does not necessarilyimply that a user is able to realize differences during visualperception when observing a representation of the output signal 34compared to the original representation of the recorded object 16.

In an alternative embodiment the system 10 further comprises a buffermeans 42 and/or a storage means 44 for buffering or storing the inputsignal 24 and the output signal 34, see also the broken bypass lines inFIG. 1. Hence, besides an instant mode of operation, therefore, also amediate mode of operation is enabled. Buffering of raw data andprocessed data, e.g. in a final state or a non-final state, canfacilitate the analyzing and modification steps applied to the data.However, it is appreciated if only processed data in the final state isstored and made available for external access.

According to a first overall embodiment the system 10 can be implementedmy means of a personal computer connectable to or comprising a camera,the personal computer being driven by suitable program code or logiccommands. According to another overall embodiment the system 10 can beimplemented by means of a video surveillance system comprising aprocessing unit driven by suitable program code or logic commands.

FIG. 2, which is to be considered in conjunction with FIG. 3,illustrates several sample utilizations of a system for processing data.The sensor means 22, e.g. a video camera or a webcam, is adapted fordetecting visible electromagnetic radiation 20 reflected by the object16. Thus, the sensor means 22 captures the input signal 24, alsoreferred to as raw data. The input signal 24 can be delivered to aninterface 46 to which the input channel 26 is attached. Via theinterface 46 and the input channel 26 the input signal 24 can bedelivered to the detector means 28. Basically, the detector means 28 isadapted to carry out an analysis of the input signal 24 related to themethod disclosed in the WO 2010/100594 A2. However, the detector means28 is not adapted to make the extracted information available to anexternal unauthorized access.

Reference numeral 48 a depicts a sample captured image frame deliveredto the detector means 28. The image frame 48 a comprises arepresentation of the object 16 comprising a vital signature 50 a whichcan be drawn for subsequent analyses. As indicated by an arrow t,several captured image frames 48 b, 48 c, 48 d recorded over time andforming an input sequence 49 can be utilized for detecting the vitalsignal 18. It is required to extract the desired vital signal 18 atleast to a certain extent enabling a subsequent modification of theinput signal 24 adequately masking, hiding or modulating the vitalsignal 18 in the output signal 34 made available for external or evenpublic access.

The image frame 48 a further comprises a non-indicated signature 52 awhich is not exposed to temporal variations indicative of the vitalsignal 18 of the object 16. That is, the non-indicative signature 52 ais merely subjected to overall variations and noise generally overlayingthe whole image frame 48 a. Both a sequence of the vital signature 50 b,50 c, 50 d and a sequence of the non-indicative signature 52 b, 52 c, 52d can be compared in a way as to assess the desired vital signal 18.With respect to the detection of the desired signal it is also referredto the still unpublished European Patent application No. 09172337.9, inthe name of the same applicant as the present invention. Thisapplication depicts further refinements of a signal extraction processsuitable for the detection of vital signals from input data.

It goes without saying that, in order to achieve a sufficientpreservation of the desired level of privacy, the vital signature 50 ais preferably adapted to a whole part of the image frame 48 asubstantially comprising physiological information 54. It is thereforeappreciated that the detection of the vital signature 50 a alsocomprises a detection of relevant parts of the image frame 48 aindicative of vital signals in general. To this end, by way of example,the respective relevant parts can be formed by skin tone pixelscontained in the image frame 48 a. However, in the alternative, it canbe envisaged that merely a subpart of the respective relevant part isdrawn for the detection of the vital signal as long as it is ensuredthat the whole respective relevant part is to be modified during asubsequent modification carried out by the converter means 30, see FIG.3. In this context, it should be noted that, for illustrative purposes,the respective relevant areas such as the vital signature 50 (and alsoan artificial signature 56) provided in the figures does not cover thewhole potentially indicative area of the respective sample object 16.

In other words, when recording, by way of example, the face of an object16 the whole area of the face should be modified accordingly. In regardof a more detailed explanation of the method underlying the detection ofthe at least one vital signature 50 and of temporal variations thereof,it is referred to further statements set out below in conjunction withFIG. 6, and to WO 2010/100594 A2 as well as to EP application No.09172337.9.

Turning towards FIG. 3, the creation of the output signal 34 bymodifying the input signal 24 depending on the detected vital signature50 is illustrated. By way of example, the converter means 30 maycomprise a modulator means 62, a leveling means 64, a mask means 66 andan overall converter 68. Needless to say, the converter means 30alternatively may comprise merely one, two or three of the respectivesub-devices.

The modulator means 62 is adapted for modifying the temporal variationsof the at least one vital signature 50. After applying the conversion,the output signal 34 comprises an output sequence 60 a of output imageframes 58 a, 58 b, 58 c wherein an artificial signature 56 a, 56 b, 56 cis embedded. Temporal variations of the artificial signature 50 a, 50 b,50 c are indicative of an artificial signal 40 d. When comparing theoriginal vital signal 18 and the resulting artificial signal 40 d, itbecomes clear that a frequency modification has been carried out.Consequently, an unauthorized extraction of a desired vital signal willresult in the artificial signal 40 d no longer indicative of theoriginal vital signal 18.

In another embodiment a leveling means 64 may be applied that is adaptedto level the temporal variations of the at least one vital signature 50.It should be understood that the term “leveling” may comprise analignment thereof with overall temporal variations of a non-indicativesignature 52 of a captured image frame 48. In FIG. 3 both the sequenceof the non-indicative signature 52 b, 52 c, 52 d and the sequence of theartificial signature 56 d, 56 e, 56 f coincide to such an extent that,when an analysis is applied to the output sequence 60 b to detecttemporal variations of the at least one assumed “vital signature” (i.e.,the artificial signature 56 d, 56 e, 56 f), merely a leveled artificialsignal 40 e can be extracted therefrom. Thus, the artificial signal 40 ecannot be utilized for obtaining personal information about the object16. In FIG. 3, by means of illustration, the pattern of both thenon-indicative signature 52 b, 52 c, 52 d and the pattern of theartificial signature 56 d, 56 e, 56 f are aligned in each frame of theoutput sequence 60 b. In this regard, it is emphasized that the sequenceof the non-indicative signature 52 b, 52 c, 52 d basically remainsunchanged with respect to the sequence of captured image frames 48 b, 48c, 48 d.

In this connection, it can be envisaged that, when applying anunauthorized analysis to the extracted artificial signal 40 e, the useddetector can be further adapted for detecting the fact that a desiredvital signal is replaced by an artificial signal 40 e. But, however,such a method and the algorithm underlying the method cannot “restore”the vital signal 18 from the artificial signal 40 e.

In another embodiment the converter means 30 may comprise a mask means66 which is adapted for removing the at least one vital signature 50from the input signal 24. The mask means 66 can be further adapted toreplace the respective vital signature 50 b, 50 c, 50 d by asubstantially steady artificial signature 56 g. The artificial signature56 g may be constant over time. As mentioned above, hence, the resultcan be an impression comparable to a “china doll” skin color. Thus, whenapplying an analysis to the output sequence 60 c substantiallycharacterized by the steady artificial signature 56 g constant over timeeither, when comparing temporal variations of the artificial signature56 g (i.e., hardly detectable or even undetectable variations of theartificial signature 56 g) with noise-induced variations of anon-indicative signature 52, it can be detected, as a possible result,an artificial signal 40 f clearly indicating an error of the analysis oran artificial signal 40 g indicating that merely minor or even notemporal variations at all could be extracted.

By way of a further alternative embodiment FIG. 3 illustrates an overallconverter 68 for varying a major portion of the image frames, wherein adestructive modulation can be applied to the temporal variations of theat least one vital signature 50 b, 50 c, 50 d. As illustrated by thepatterns covering each output image frame of the output sequence 60 d, amajor portion of the, or even the whole image frame can be modified inthis way. So, besides the artificial signatures 56 h, 56 i, 56 j, alsothe remaining parts of each frame can be subjected to the modulation.The modulation can also comprise random elements for carrying out arandom multi-mixing of image elements of output image frames of theoutput sequence 60 d. Hence, when subjecting the output sequence 60 d toan analysis so as to determine temporal variations of the at leastdesired vital signature 50, eventually merely an artificial signal 40 hcan be derived therefrom clearly indicating an error.

Again, it should be noted that preferably, even if an overallmodification is carried out to a certain extent sufficient for replacingthe original vital signal 18, these modifications do not become obviousto a human observer.

The processes data, namely the output signal 34 can be made available ata data access interface 70 to which the output channel 32 can beconnected.

Referring to FIG. 4 and FIG. 5, two alternative embodiments of systems10 a, 10 b for processing data are illustrated. Both systems 10 a, 10 bcomprise a sensor means 22, a buffer means 42, a detector means 28, astorage means 44, and a data access interface 70.

However, the system 10 a further comprises an enhanced level of privacypreservation as, firstly, the buffer means 42, the detector means 28,and the converter means 30 are arranged in a subsystem 12, while,secondly, the buffer means 42 is further surrounded by an accessprotection 72. It can be envisaged that also the sensor means 22 iscovered by the subsystem 12 or the access protection 72.

As shown in FIG. 4, the main components of the system 10 a subjected tounauthorized data access are disposed in the subsystem 12 such that anunauthorized access is impeded to a certain level. Further, thecomponent most susceptible to an unauthorized access, namely the buffermeans 42, can be hermetically housed in order to prevent unauthorizedmechanical or electronic access.

In contrast, the system 10 b is adapted to operate in two operationmodes, namely a first, privacy preservation mode and a second, raw dataaccess mode. To this end, an access control 74, substantially providinga switching function, is arranged between the buffer means 42 and thedetector means 28. In the first operation mode the access controlcouples the buffer means 42 with the detector means 28 so that the inputsignal 24 can be delivered thereto. In the second mode the accesscontrol couples the buffer means 42 via a bypass 76 to the data accessinterface 70. Thus, the input signal 24 can bypass the detector means 28and the converter means 30 and can be made available to external dataaccess via the data access interface 70. It is worth noting that, inthis embodiment, the authority to actuate the access control 74 shouldbe limited to special events or incidents and, moreover, restricted to aconsiderably small trustful group of users.

FIG. 6 schematically illustrates a method for processing data.Initially, in a step 78 data is received or acquired. The data can bedelivered from a sensor means 22 or a buffer means 42. In a subsequentstep 80 at least one vital signature 50 e, 50 f, 50 g is detected in aninput sequence 49 of the input signal. As an advantageous supplement, asindicated by broken arrows, a color normalization 84 and/or a luminancenormalization 86 can be applied to a set of signal spaces 82 a, 82 b, 82c wherein the desired variations indicative of temporal variations ofthe detected vital signatures 50 e, 50 f, 50 g can be depicted.Consequently, the problem of extracting a vital signal 18, illustratedby a step 90, can be facilitated, by way of example, in that amulti-dimensional problem can be transferred to a two-dimensionalproblem as indicated by the normalized signal spaces 88 a, 88 b, 88 c.It goes without saying that the steps 84 and 86 alternatively may followor precede each other.

After having extracted the relevant information, namely the vital signal18 indicative of personal information to be preserved, this informationcan be utilized for modifying the input signal, step 92, in a way as tomerely allow the extraction of an artificial signal 40 i therefrom.Eventually, the modified output signal can be delivered and distributed,step 94.

FIG. 7, by way of example, illustrates a luminance normalization appliedto a sample signal space 92 d. The signal space 92 d can be considered aRGB space having three axes 96 a, 96 b, 96 c, each respective of adistinct main color value. To this signal space 82 d a luminancenormalization is applied by a determined linear combination of singlevalues (e.g., R-value+G-value+B-value=constant) leading to a dimensionalreduction of the underlying problem. Thus, a normalized signal space 88resulting therefrom can be considered a plane. The normalized signalspace comprises a heart beat axis 98 which can be determined empiricallyby approximative measures. A detected signal 100 is representative oftemporal variations of an at least one vital signature. However, besidesthe vital component, the detected signal 100 is also representative ofoverall temporal variations, such as noise and the like, overlaying acaptured image frame. By projecting the detected signal 100 to thepredetermined heart beat axis 98 a projected signal 102 indicative of atemporal value of the desired vital signal can be estimated avoidingdisturbing components having a perpendicular orientation with respect tothe heart beat axis 98.

In this context it is worth noting that the sample signal space 82 dillustrates actual difference values representative of the temporalvariations of interest. A color normalization carried out consecutivelyto or before the luminance normalization can further contributefacilitating the extraction of the desired vital signal.

Hence, the vital signal can be extracted from the input signal, and,moreover, utilized for modifying the input signal in order to preserveprivacy information. After being subjected to the modification, merely a“fake signal” can be detected having a length and orientation clearlydifferent from a length and orientation of the detected signal 100.Thus, the vital signal cannot be restored.

While the invention has been illustrated and described in detail in thedrawings and foregoing description, such illustration and descriptionare to be considered illustrative or exemplary and not restrictive; theinvention is not limited to the disclosed embodiments. Other variationsto the disclosed embodiments can be understood and effected by thoseskilled in the art in practicing the claimed invention, from a study ofthe drawings, the disclosure, and the appended claims.

In the claims, the word “comprising” does not exclude other elements orsteps, and the indefinite article “a” or “an” does not exclude aplurality. A single element or other unit may fulfill the functions ofseveral items recited in the claims. The mere fact that certain measuresare recited in mutually different dependent claims does not indicatethat a combination of these measures cannot be used to advantage.

A computer program may be stored/distributed on a suitable medium, suchas an optical storage medium or a solid-state medium supplied togetherwith or as part of other hardware, but may also be distributed in otherforms, such as via the Internet or other wired or wirelesstelecommunication systems.

Any reference signs in the claims should not be construed as limitingthe scope.

The invention claimed is:
 1. A privacy system for processing dataobtained from an input signal comprising physiological informationderived from radiation reflected by a person, the physiologicalinformation being representative of at least one vital signal of theperson, the system comprising: a detector configured to detect at leastone vital signature in the input signal, wherein the input signalcomprises a continuous or discrete sequence of image frames related to aspecific signal space, the at least one vital signature varying overtime and corresponding to variations of the at least one vital signal,and wherein the at least one vital signal is obtained from variations ofskin color over time; and a converter configured to create an outputsignal by modifying the input signal depending on the detected vitalsignature, wherein the output signal comprises an artificial signatureat least partially replacing a respective vital signature portion of theat least one vital signature of the input signal.
 2. The privacy systemas claimed in claim 1, wherein the continuous or discrete sequence ofimage frames comprises a representation of the person, therepresentation of the person comprising the at least one vitalsignature, wherein the at least one vital signal is at least a partiallyperiodic vital signal of the person, and wherein the detector is furtherconfigured to detect temporal variations of the at least one vitalsignature, the temporal variations of the at least one vital signaturecorresponding to temporal variations of at least partially periodicvital signal.
 3. The privacy system as claimed in claim 2, wherein theconverter includes one of a leveler configured to level the temporalvariations of the at least one vital signature, a mask configured toremove the at least one vital signature from the input signal, anevaluation facilitator configured to enhance an amplitude of the vitalsignal, and a modulator configured to apply a frequency modification tothe temporal variations.
 4. The privacy system as claimed in claim 2,wherein the converter is an overall converter for varying a majorportion of the image frames, the major portion comprising the at leastone vital signature and a non-indicative signature, and wherein theoverall converter is configured to apply a destructive modulation to thetemporal variations of the at least one vital signature.
 5. The privacysystem as claimed in claim 4, further comprising a buffer configured tobuffer the input signal, wherein access to the buffer is providedthrough an access protector configured to prevent an unauthorized accessof data stored in the buffer.
 6. The privacy system of claim 5, whereinthe access protection includes a first housing configured to house thebuffer, the detector and the converter, and the access protectionfurther including a second housing configured to hermetically house thebuffer.
 7. The privacy preservation system as claimed in claim 2,wherein the converter is further configured to apply a multi stageconversion to the at least one vital signature.
 8. The privacy system asclaimed in claim 1, further comprising a sensor configured to detect theradiation within at least one particular wavelength range selected fromthe group consisting of visible light, infrared light, and ultravioletradiation, the sensor being connectable to the input channel.
 9. Theprivacy system as claimed in claim 1, wherein the detector is furtherconfigured to apply a color normalization and a luminance normalizationto the signal space.
 10. The privacy system of claim 1, wherein thecontinuous or discrete sequence of image frames comprises arepresentation of the person, the representation of the personcomprising the at least one vital signature, wherein the at least onevital signal is at least a partially periodic and is selected from agroup consisting of heart rate, respiration rate, and heart ratevariability.
 11. The privacy system of claim 1, wherein the converter isconfigured to receive the at least one vital signature from the detectorand to create the artificial signature by modifying the at least onevital signature.
 12. A privacy preservation method for processing dataobtained from an input signal comprising physiological informationderived from radiation reflected by a person, the physiologicalinformation being representative of at least one vital signal of theperson, the method comprising acts of: receiving an input signal from aninput channel; detecting by a detector at least one vital signature inthe input signal, wherein the input signal comprises a continuous ordiscrete sequence of image frames related to a specific signal space,the at least one vital signature varying over time and corresponding tovariations of the at least one vital signal, and wherein the at leastone vital signal is obtained from variations of skin color over time;creating by a converter an output signal by modifying the input signaldepending on the detected vital signature, wherein the output signalcomprises an artificial signature at least partially replacing arespective vital signature of the at least one vital signature of theinput signal; and delivering the output signal to an output channel. 13.The privacy preservation method of claim 12, wherein the continuous ordiscrete sequence of image frames comprises a representation of theperson, the representation of the person comprising the at least onevital signature, wherein the at least one vital signal is at least apartially periodic and is selected from a group consisting of heartrate, respiration rate, and heart rate variability.
 14. The privacypreservation method of claim 12, wherein the creating act furthercomprises creating the artificial signature by modifying the at leastone vital signature of the input signal.
 15. The privacy preservationmethod of claim 12, wherein the creating act modifies the at least onevital signature of the input signal by at least one of: levelingtemporal variations of the at least one vital signature, removing the atleast one vital signature from the input signal, enhancing an amplitudeof the vital signal, and applying a frequency modification to thetemporal variations.
 16. The privacy preservation method of claim 12,wherein the converter is an overall converter for varying a majorportion of the image frames, the major portion comprising the at leastone vital signature and a non-indicative signature, and wherein theoverall converter is configured to apply a destructive modulation totemporal variations of the at least one vital signature.
 17. Anon-transitory computer readable medium comprising computer instructionswhich, when executed by a processor, configure the processor to performa privacy preservation method for processing data obtained from an inputsignal comprising physiological information derived from radiationreflected by person, the physiological information being representativeof at least one vital signal of the person, the method comprising actsof: receiving an input signal from an input channel; determining atleast one vital signature in the input signal, wherein the input signalcomprises a continuous or discrete sequence of image frames related to aspecific signal space, the at least one vital signature varying overtime and corresponding to variations of the at least one vital signal,and wherein the at least one vital signal is obtained from variations ofskin color over time; creating an output signal by modifying the inputsignal depending on the determined vital signature, wherein the outputsignal comprises an artificial signature at least partially replacing arespective vital signature of the at least one vital signature of theinput signal; and delivering the output signal to an output channel. 18.The non-transitory computer readable medium of claim 17, wherein thecontinuous or discrete sequence of image frames comprises arepresentation of the person, the representation of the personcomprising the at least one vital signature, wherein the at least onevital signal is at least a partially periodic and is selected from agroup consisting of heart rate, respiration rate, and heart ratevariability.
 19. The non-transitory computer readable medium of claim17, wherein the creating act further comprises creating the artificialsignature by modifying the at least one vital signature of the inputsignal.
 20. The non-transitory computer readable medium of claim 17,wherein the creating act modifies the at least one vital signature ofthe input signal by at least one of: leveling temporal variations of theat least one vital signature, removing the at least one vital signaturefrom the input signal, enhancing an amplitude of the vital signal, andapplying a frequency modification to the temporal variations.